When you transport medical specimens, records, or pharmaceuticals, you become part of the healthcare supply chain — and that means HIPAA applies to you. Medical couriers are classified as Business Associates under the Health Insurance Portability and Accountability Act, which carries real legal weight.
What Makes a Courier a "Business Associate"?
HIPAA defines a Business Associate as any person or company that performs services involving Protected Health Information (PHI) on behalf of a Covered Entity (a hospital, lab, or clinic). Because medical couriers handle PHI — even if it's just a lab requisition attached to a specimen — that definition applies.
Your Key Obligations
- Never open, read, or share any patient information you encounter during a delivery
- Report any suspected breach of PHI to your contracting company immediately
- Follow all chain of custody documentation procedures without exception
- Secure specimens and records so they cannot be accessed by unauthorized persons during transport
- Complete HIPAA training before beginning work — not after
What Counts as PHI?
Protected Health Information includes any data that could identify a patient in connection with their health condition or care. In a courier context, this includes names on lab labels, patient account numbers on paperwork, dates of service, and addresses on delivery manifests.
The Consequences of Non-Compliance
HIPAA violations carry civil penalties ranging from $100 to $50,000 per violation depending on the level of negligence. Criminal penalties apply when violations are knowing and willful. As a Business Associate, you are not shielded by the healthcare facility you deliver for — you carry your own liability.
Milagro's online HIPAA training course is $19.99 — take it today and get priority consideration for routes.